<!DOCTYPE HTML>
<html lang="zh">
<head>
<title>Nginx 中文文档 - Module ngx_mail_ssl_module | Docs4dev</title>
<meta charset="UTF-8">
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
<meta name="description" content="Nginx (engine x) 是一个高性能的HTTP和反向代理服务，也是一个IMAP/POP3/SMTP服务。">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="HandheldFriendly" content="true">
<meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no">
<meta name="apple-mobile-web-app-capable" content="yes">
<meta name="apple-mobile-web-app-status-bar-style" content="black">
<meta property="og:type" content="website">
<meta property="og:title" content="Nginx 中文文档 - Module ngx_mail_ssl_module">
<meta property="og:url" content="https://www.docs4dev.com/docs/zh/nginx/current/reference/mail-ngx_mail_ssl_module.html">
<meta property="og:site_name" content="Docs4dev">
<meta property="og:locale" content="zh_CN">
<meta name="twitter:card" content="Nginx (engine x) 是一个高性能的HTTP和反向代理服务，也是一个IMAP/POP3/SMTP服务。">
<meta name="generator" content="Docs4dev template engine">
<link rel="stylesheet" href="static/css/app.min.css">
<link rel="shortcut icon" href="https://www.docs4dev.com/static/images/favicon.ico" type="image/x-icon">
<script async="" src="static/js/js.js"></script>
<script async="" src="static/js/adsbygoogle.js" crossorigin="anonymous"></script>
<script>
    window.dataLayer = window.dataLayer || [];

    function gtag() {
      dataLayer.push(arguments);
    }

    gtag('js', new Date());
    gtag('config', 'UA-129571937-1');
  </script>
<link rel="amphtml" href="https://www.docs4dev.com/amp/docs/zh/nginx/current/reference/mail-ngx_mail_ssl_module.html">
<script type="application/ld+json">{"name":null,"headline":"Nginx 中文文档-Module ngx_mail_ssl_module","inLanguage":"zh-CN","version":"current","image":"/static/icon/icon-nginx.svg","datePublished":"2021-05-20T12:51:01Z","dateCreated":"2021-05-20T12:51:01Z","dateModified":"2021-07-07T12:48:29Z","@context":"https://schema.org/","@type":"APIReference","abstract":"Nginx (engine x) 是一个高性能的HTTP和反向代理服务，也是一个IMAP/POP3/SMTP服务。"}</script>
</head>
<body>
<div class="book with-summary">
<div class="book-summary">
<div class="logo">
<a href="index.html" style="color: inherit;">
<img src="static/picture/icon-nginx.svg" style="width: 48px; height: 48px;" alt="Logo">
</a>
<b style="color: inherit; margin-left: 8px;">Nginx 中文文档</b>
</div>
<div class="item">
<div>
<label for="version">版本</label>
<select id="version" onchange="onVersionChange(this)">
<option value="current" selected="selected">current</option>
</select>
</div>
<div style="margin-top: 8px;">
<label for="language">语言</label>
<select id="language" onchange="onLangChange(this)" value="zh">
<option value="en">English</option>
<option value="zh" selected="selected">中文</option>
</select>
</div>

</div>
<div class="item menus">
<a title="Table of Contents" style="margin-right: 8px;" href="index.html">
<i class="fa fa-chevron-left"></i>
<span style="margin-left: 2px;">返回目录</span>
</a>
</div>
<nav role="navigation" id="navigation">
<ul class="summary">
<li class="chapter"> <a href="install.html" title="Introduction"> Introduction </a>
<ul class="articles">
<li class="chapter"> <a href="install.html" title="Installing nginx"> Installing nginx </a> </li>
<li class="chapter"> <a href="configure.html" title="从源代码构建  Nginx"> 从源代码构建 Nginx </a> </li>
<li class="chapter"> <a href="beginners_guide.html" title="Beginner's Guide"> Beginner's Guide </a> </li>
<li class="chapter"> <a href="control.html" title="Controlling nginx"> Controlling nginx </a> </li>
<li class="chapter"> <a href="events.html" title="连接处理方法"> 连接处理方法 </a> </li>
<li class="chapter"> <a href="hash.html" title="设置哈希"> 设置哈希 </a> </li>
<li class="chapter"> <a href="debugging_log.html" title="调试日志"> 调试日志 </a> </li>
<li class="chapter"> <a href="syslog.html" title="记录到系统日志"> 记录到系统日志 </a> </li>
<li class="chapter"> <a href="syntax.html" title="配置文件测量单位"> 配置文件测量单位 </a> </li>
<li class="chapter"> <a href="switches.html" title="Command-line parameters"> Command-line parameters </a> </li>
<li class="chapter"> <a href="windows.html" title="Windows 版  Nginx"> Windows 版 Nginx </a> </li>
<li class="chapter"> <a href="http-request_processing.html" title="Nginx 如何处理请求"> Nginx 如何处理请求 </a> </li>
<li class="chapter"> <a href="http-server_names.html" title="Server names"> Server names </a> </li>
<li class="chapter"> <a href="http-load_balancing.html" title="使用  Nginx 作为  HTTP 负载均衡器"> 使用 Nginx 作为 HTTP 负载均衡器 </a> </li>
<li class="chapter"> <a href="http-configuring_https_servers.html" title="配置  HTTPS 服务器"> 配置 HTTPS 服务器 </a> </li>
<li class="chapter"> <a href="stream-stream_processing.html" title="Nginx 如何处理  TCP/UDP 会话"> Nginx 如何处理 TCP/UDP 会话 </a> </li>
<li class="chapter"> <a href="njs-index.html" title="用  njs 编写脚本"> 用 njs 编写脚本 </a> </li>
</ul> </li>
<li class="chapter"> <a href="howto_build_on_win32.html" title="How-To"> How-To </a>
<ul class="articles">
<li class="chapter"> <a href="howto_build_on_win32.html" title="使用  Visual C 在  Win32 平台上构建  Nginx"> 使用 Visual C 在 Win32 平台上构建 Nginx </a> </li>
<li class="chapter"> <a href="nginx_dtrace_pid_provider.html" title="使用  DTrace pid 提供程序调试  nginx"> 使用 DTrace pid 提供程序调试 nginx </a> </li>
<li class="chapter"> <a href="http-converting_rewrite_rules.html" title="转换重写规则"> 转换重写规则 </a> </li>
<li class="chapter"> <a href="http-websocket.html" title="WebSocket proxying"> WebSocket proxying </a> </li>
</ul> </li>
<li class="chapter"> <a href="contributing_changes.html" title="Development"> Development </a>
<ul class="articles">
<li class="chapter"> <a href="contributing_changes.html" title="Contributing Changes"> Contributing Changes </a> </li>
<li class="chapter"> <a href="dev-development_guide.html" title="Development guide"> Development guide </a> </li>
</ul> </li>
<li class="chapter"> <a href="dirindex.html" title="Modules reference"> Modules reference </a>
<ul class="articles">
<li class="chapter"> <a href="dirindex.html" title="指令的字母索引"> 指令的字母索引 </a> </li>
<li class="chapter"> <a href="varindex.html" title="变量按字母顺序索引"> 变量按字母顺序索引 </a> </li>
<li class="chapter"> <a href="ngx_core_module.html" title="Core functionality"> Core functionality </a> </li>
<li class="chapter"> <a href="http-ngx_http_core_module.html" title="ngx_http_core_module"> ngx_http_core_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_access_module.html" title="ngx_http_access_module"> ngx_http_access_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_addition_module.html" title="ngx_http_addition_module"> ngx_http_addition_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_api_module.html" title="ngx_http_api_module"> ngx_http_api_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_auth_basic_module.html" title="ngx_http_auth_basic_module"> ngx_http_auth_basic_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_auth_jwt_module.html" title="ngx_http_auth_jwt_module"> ngx_http_auth_jwt_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_auth_request_module.html" title="ngx_http_auth_request_module"> ngx_http_auth_request_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_autoindex_module.html" title="ngx_http_autoindex_module"> ngx_http_autoindex_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_browser_module.html" title="ngx_http_browser_module"> ngx_http_browser_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_charset_module.html" title="ngx_http_charset_module"> ngx_http_charset_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_dav_module.html" title="ngx_http_dav_module"> ngx_http_dav_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_empty_gif_module.html" title="ngx_http_empty_gif_module"> ngx_http_empty_gif_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_f4f_module.html" title="ngx_http_f4f_module"> ngx_http_f4f_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_fastcgi_module.html" title="ngx_http_fastcgi_module"> ngx_http_fastcgi_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_flv_module.html" title="ngx_http_flv_module"> ngx_http_flv_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_geo_module.html" title="ngx_http_geo_module"> ngx_http_geo_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_geoip_module.html" title="ngx_http_geoip_module"> ngx_http_geoip_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_grpc_module.html" title="ngx_http_grpc_module"> ngx_http_grpc_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_gunzip_module.html" title="ngx_http_gunzip_module"> ngx_http_gunzip_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_gzip_module.html" title="ngx_http_gzip_module"> ngx_http_gzip_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_gzip_static_module.html" title="ngx_http_gzip_static_module"> ngx_http_gzip_static_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_headers_module.html" title="ngx_http_headers_module"> ngx_http_headers_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_hls_module.html" title="ngx_http_hls_module"> ngx_http_hls_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_image_filter_module.html" title="ngx_http_image_filter_module"> ngx_http_image_filter_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_index_module.html" title="ngx_http_index_module"> ngx_http_index_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_js_module.html" title="ngx_http_js_module"> ngx_http_js_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_keyval_module.html" title="ngx_http_keyval_module"> ngx_http_keyval_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_limit_conn_module.html" title="ngx_http_limit_conn_module"> ngx_http_limit_conn_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_limit_req_module.html" title="ngx_http_limit_req_module"> ngx_http_limit_req_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_log_module.html" title="ngx_http_log_module"> ngx_http_log_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_map_module.html" title="ngx_http_map_module"> ngx_http_map_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_memcached_module.html" title="ngx_http_memcached_module"> ngx_http_memcached_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_mirror_module.html" title="ngx_http_mirror_module"> ngx_http_mirror_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_mp4_module.html" title="ngx_http_mp4_module"> ngx_http_mp4_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_perl_module.html" title="ngx_http_perl_module"> ngx_http_perl_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_proxy_module.html" title="ngx_http_proxy_module"> ngx_http_proxy_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_random_index_module.html" title="ngx_http_random_index_module"> ngx_http_random_index_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_realip_module.html" title="ngx_http_realip_module"> ngx_http_realip_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_referer_module.html" title="ngx_http_referer_module"> ngx_http_referer_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_rewrite_module.html" title="ngx_http_rewrite_module"> ngx_http_rewrite_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_scgi_module.html" title="ngx_http_scgi_module"> ngx_http_scgi_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_secure_link_module.html" title="ngx_http_secure_link_module"> ngx_http_secure_link_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_session_log_module.html" title="ngx_http_session_log_module"> ngx_http_session_log_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_slice_module.html" title="ngx_http_slice_module"> ngx_http_slice_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_spdy_module.html" title="ngx_http_spdy_module"> ngx_http_spdy_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_split_clients_module.html" title="ngx_http_split_clients_module"> ngx_http_split_clients_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_ssi_module.html" title="ngx_http_ssi_module"> ngx_http_ssi_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_ssl_module.html" title="ngx_http_ssl_module"> ngx_http_ssl_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_status_module.html" title="ngx_http_status_module"> ngx_http_status_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_stub_status_module.html" title="ngx_http_stub_status_module"> ngx_http_stub_status_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_sub_module.html" title="ngx_http_sub_module"> ngx_http_sub_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_upstream_module.html" title="ngx_http_upstream_module"> ngx_http_upstream_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_upstream_conf_module.html" title="ngx_http_upstream_conf_module"> ngx_http_upstream_conf_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_upstream_hc_module.html" title="ngx_http_upstream_hc_module"> ngx_http_upstream_hc_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_userid_module.html" title="ngx_http_userid_module"> ngx_http_userid_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_uwsgi_module.html" title="ngx_http_uwsgi_module"> ngx_http_uwsgi_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_v2_module.html" title="ngx_http_v2_module"> ngx_http_v2_module </a> </li>
<li class="chapter"> <a href="http-ngx_http_xslt_module.html" title="ngx_http_xslt_module"> ngx_http_xslt_module </a> </li>
<li class="chapter"> <a href="mail-ngx_mail_core_module.html" title="ngx_mail_core_module"> ngx_mail_core_module </a> </li>
<li class="chapter"> <a href="mail-ngx_mail_auth_http_module.html" title="ngx_mail_auth_http_module"> ngx_mail_auth_http_module </a> </li>
<li class="chapter"> <a href="mail-ngx_mail_proxy_module.html" title="ngx_mail_proxy_module"> ngx_mail_proxy_module </a> </li>
<li class="chapter"> <a href="" title="ngx_mail_ssl_module"> ngx_mail_ssl_module </a> </li>
<li class="chapter"> <a href="mail-ngx_mail_imap_module.html" title="ngx_mail_imap_module"> ngx_mail_imap_module </a> </li>
<li class="chapter"> <a href="mail-ngx_mail_pop3_module.html" title="ngx_mail_pop3_module"> ngx_mail_pop3_module </a> </li>
<li class="chapter"> <a href="mail-ngx_mail_smtp_module.html" title="ngx_mail_smtp_module"> ngx_mail_smtp_module </a> </li>
<li class="chapter"> <a href="stream-ngx_stream_core_module.html" title="ngx_stream_core_module"> ngx_stream_core_module </a> </li>
<li class="chapter"> <a href="stream-ngx_stream_access_module.html" title="ngx_stream_access_module"> ngx_stream_access_module </a> </li>
<li class="chapter"> <a href="stream-ngx_stream_geo_module.html" title="ngx_stream_geo_module"> ngx_stream_geo_module </a> </li>
<li class="chapter"> <a href="stream-ngx_stream_geoip_module.html" title="ngx_stream_geoip_module"> ngx_stream_geoip_module </a> </li>
<li class="chapter"> <a href="stream-ngx_stream_js_module.html" title="ngx_stream_js_module"> ngx_stream_js_module </a> </li>
<li class="chapter"> <a href="stream-ngx_stream_keyval_module.html" title="ngx_stream_keyval_module"> ngx_stream_keyval_module </a> </li>
<li class="chapter"> <a href="stream-ngx_stream_limit_conn_module.html" title="ngx_stream_limit_conn_module"> ngx_stream_limit_conn_module </a> </li>
<li class="chapter"> <a href="stream-ngx_stream_log_module.html" title="ngx_stream_log_module"> ngx_stream_log_module </a> </li>
<li class="chapter"> <a href="stream-ngx_stream_map_module.html" title="ngx_stream_map_module"> ngx_stream_map_module </a> </li>
<li class="chapter"> <a href="stream-ngx_stream_proxy_module.html" title="ngx_stream_proxy_module"> ngx_stream_proxy_module </a> </li>
<li class="chapter"> <a href="stream-ngx_stream_realip_module.html" title="ngx_stream_realip_module"> ngx_stream_realip_module </a> </li>
<li class="chapter"> <a href="stream-ngx_stream_return_module.html" title="ngx_stream_return_module"> ngx_stream_return_module </a> </li>
<li class="chapter"> <a href="stream-ngx_stream_split_clients_module.html" title="ngx_stream_split_clients_module"> ngx_stream_split_clients_module </a> </li>
<li class="chapter"> <a href="stream-ngx_stream_ssl_module.html" title="ngx_stream_ssl_module"> ngx_stream_ssl_module </a> </li>
<li class="chapter"> <a href="stream-ngx_stream_ssl_preread_module.html" title="ngx_stream_ssl_preread_module"> ngx_stream_ssl_preread_module </a> </li>
<li class="chapter"> <a href="stream-ngx_stream_upstream_module.html" title="ngx_stream_upstream_module"> ngx_stream_upstream_module </a> </li>
<li class="chapter"> <a href="stream-ngx_stream_upstream_hc_module.html" title="ngx_stream_upstream_hc_module"> ngx_stream_upstream_hc_module </a> </li>
<li class="chapter"> <a href="stream-ngx_stream_zone_sync_module.html" title="ngx_stream_zone_sync_module"> ngx_stream_zone_sync_module </a> </li>
<li class="chapter"> <a href="ngx_google_perftools_module.html" title="ngx_google_perftools_module"> ngx_google_perftools_module </a> </li>
</ul> </li>
</ul>
</nav>
</div>
<div class="book-body">
<div class="body-inner">
<header class="book-header">
<div class="dropdown pull-right js-toolbar-action">
<a class="btn toggle-dropdown" aria-label="Language" href="#">
<i class="fa fa-globe"></i>
</a>
<div class="dropdown-menu dropdown-left">
<div class="dropdown-caret"><span class="caret-outer"></span><span class="caret-inner"></span></div>
<div class="buttons">
<button class="button size-1" onclick="changeLang('zh_CN')">中文</button>
</div>
<div class="buttons">
<button class="button size-1" onclick="changeLang('en_US')">English</button>
</div>
</div>
</div>
<a class="btn pull-right js-toolbar-action non-mobile" aria-label="Sign up" href="register.html">
<i class="fa fa-sign-in"></i> <span>注册</span>
</a>
 <a class="btn pull-right js-toolbar-action non-mobile" aria-label="Sign in" href="register.html">
<i class="fa fa-sign-in"></i>
<span>登录</span>
</a>
<a class="btn pull-left js-toolbar-action btn-summary" href="#"><i class="fa fa-align-justify"></i></a>
<div class="dropdown pull-left font-settings js-toolbar-action">
<a class="btn toggle-dropdown" aria-label="Font Settings" href="#">
<i class="fa fa-font"></i>
</a>
<div class="dropdown-menu dropdown-right">
<div class="dropdown-caret"><span class="caret-outer"></span><span class="caret-inner"></span></div>
<div class="buttons">
<button class="button size-2 font-reduce">A</button>
<button class="button size-2 font-enlarge">A</button>
</div>
<div class="buttons">
<button class="button size-2 family-serif">Serif</button>
<button class="button size-2 family-sans">Sans</button>
</div>
<div class="buttons">
<button class="button size-3 theme-white">White</button>
<button class="button size-3 theme-sepia">Sepia</button>
<button class="button size-3 theme-night">Night</button>
</div>
</div>
</div>
<a class="btn pull-left js-toolbar-action non-mobile" aria-label="Home" href="zh.html">
<i class="fa fa-home"></i> <span>首页</span>
</a>
<a class="btn pull-left js-toolbar-action non-mobile" aria-label="Guide" href="javascript:window.open('https://www.javadoc.org/');">
<i class="fa fa-book"></i> <span>API Docs</span>
</a>
<a class="btn pull-left js-toolbar-action non-mobile" aria-label="Tools" href="index1.html">
<i class="fa fa-gears"></i> <span>工具</span>
</a>
<div class="dropdown pull-left js-toolbar-action mobile">
<a class="btn toggle-dropdown" aria-label="Language" href="#">
<i class="fa fa-chevron-down"></i>
</a>
<div class="dropdown-menu dropdown-right">
<div class="dropdown-caret"><span class="caret-outer"></span><span class="caret-inner"></span></div>
<div class="buttons">
<a class="button size-1" aria-label="Home" href="zh.html">
<i class="fa fa-home"></i> <span>首页</span>
</a>
</div>
<div class="buttons">
<a class="button size-1" aria-label="Guide" href="javascript:window.open('https://www.javadoc.org/');">
<i class="fa fa-book"></i> <span>API Docs</span>
</a>
</div>
<div class="buttons">
<a class="button size-1" aria-label="Tools" href="index1.html">
<i class="fa fa-gears"></i> <span>工具</span>
</a>
</div>
</div>
</div>
<div id="autocomplete" class="pull-right"></div>
<span id="toolbar-title"></span>
</header>
<div class="page-wrapper" tabindex="-1" role="main">
<div class="page-inner">
<section class="normal markdown-section">
<div id="content">
<h1>Module ngx_mail_ssl_module</h1>
<div><ins class="adsbygoogle" style="display:block; text-align:center;" data-ad-layout="in-article" data-ad-format="fluid" data-ad-client="ca-pub-6108808167664152" data-ad-slot="6964403648"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script></div>
<div><ul>
<li><a href="#example">Example Configuration</a></li>
<li><a href="#directives">Directives</a>
<ul>
<li><a href="#ssl">ssl</a></li>
<li><a href="#ssl_certificate">ssl_certificate</a></li>
<li><a href="#ssl_certificate_key">ssl_certificate_key</a></li>
<li><a href="#ssl_ciphers">ssl_ciphers</a></li>
<li><a href="#ssl_client_certificate">ssl_client_certificate</a></li>
<li><a href="#ssl_crl">ssl_crl</a></li>
<li><a href="#ssl_dhparam">ssl_dhparam</a></li>
<li><a href="#ssl_ecdh_curve">ssl_ecdh_curve</a></li>
<li><a href="#ssl_password_file">ssl_password_file</a></li>
<li><a href="#ssl_prefer_server_ciphers">ssl_prefer_server_ciphers</a></li>
<li><a href="#ssl_protocols">ssl_protocols</a></li>
<li><a href="#ssl_session_cache">ssl_session_cache</a></li>
<li><a href="#ssl_session_ticket_key">ssl_session_ticket_key</a></li>
<li><a href="#ssl_session_tickets">ssl_session_tickets</a></li>
<li><a href="#ssl_session_timeout">ssl_session_timeout</a></li>
<li><a href="#ssl_trusted_certificate">ssl_trusted_certificate</a></li>
<li><a href="#ssl_verify_client">ssl_verify_client</a></li>
<li><a href="#ssl_verify_depth">ssl_verify_depth</a></li>
<li><a href="#starttls">starttls</a><br><a href="" id="summary"></a></li>
</ul>
</li>
</ul>
<p><code>ngx_mail_ssl_module</code>模块为邮件代理服务器使用 SSL/TLS 协议提供必要的支持。</p>
<p>默认情况下未构建此模块，应使用<code>--with-mail_ssl_module</code>配置参数启用它。</p>
<div class="alert callout info"><p class="title"><i class="fa fa-info-circle"></i>Note</p><div><p>此模块需要<a href="javascript:window.open('https://www.openssl.org/');" target="_blank" rel="noopener noreferrer">OpenSSL</a>库。</p>
</div></div>
<p><a href="" id="example"></a></p>
<h4 id="example-configuration"><a href="#example-configuration" id="example-configuration"></a>Example Configuration</h4>
<p>为了减少处理器负载，建议</p>
<ul>
<li>
<p>将<a href="ngx_core_module.html#worker_processes">worker processes</a>的数量设置为等于处理器的数量，</p>
</li>
<li>
<p>启用<a href="#ssl_session_cache_shared">shared</a>会话缓存，</p>
</li>
<li>
<p>禁用<a href="#ssl_session_cache_builtin">built-in</a>会话缓存，</p>
</li>
<li>
<p>并可能增加会话<a href="#ssl_session_timeout">lifetime</a>(默认情况下为 5 分钟)：</p>
</li>
</ul>
<pre><code class="hljs language-shell">worker_processes auto;

mail {

    ...

    server {
        listen              993 ssl;

        ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers         AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5;
        ssl_certificate     /usr/local/nginx/conf/cert.pem;
        ssl_certificate_key /usr/local/nginx/conf/cert.key;
        ssl_session_cache   shared:SSL:10m;
        ssl_session_timeout 10m;

        ...
    }
</code></pre>
<p><a href="" id="directives"></a></p>
<h4 id="directives"><a href="#directives" id="directives"></a>Directives</h4>
<p><a href="" id="ssl"></a></p>
<table>
<thead></thead>
<tbody>
<tr><td>Syntax:</td><td><code>ssl on | off;</code></td></tr>
<tr><td>Default:</td><td><code>ssl off;</code></td></tr>
<tr><td>Context:</td><td><code>mail</code> , <code>server</code></td></tr>
</tbody>
</table>
<p>该指令在版本 1.15.0 中已作废。应该改为使用<a href="mail-ngx_mail_core_module.html#listen">listen</a>指令的<code>ssl</code>参数。</p>
<p><a href="" id="ssl_certificate"></a></p>
<table>
<thead></thead>
<tbody>
<tr><td>Syntax:</td><td><code>ssl_certificate file;</code></td></tr>
<tr><td>Default:</td><td>—</td></tr>
<tr><td>Context:</td><td><code>mail</code> , <code>server</code></td></tr>
</tbody>
</table>
<p>使用给定服务器的 PEM 格式的证书指定<code>file</code>。如果除主要证书之外还应指定中间证书，则应按以下顺序在同一文件中指定它们：首先是主要证书，然后是中间证书。 PEM 格式的密钥可以放置在同一文件中。</p>
<p>从 1.11.0 版开始，可以多次指定此伪指令以加载不同类型的证书，例如 RSA 和 ECDSA：</p>
<pre><code class="hljs language-shell">server {
    listen              993 ssl;

    ssl_certificate     example.com.rsa.crt;
    ssl_certificate_key example.com.rsa.key;

    ssl_certificate     example.com.ecdsa.crt;
    ssl_certificate_key example.com.ecdsa.key;

    ...
}
</code></pre>
<div class="alert callout info"><p class="title"><i class="fa fa-info-circle"></i>Note</p><div><p>仅 OpenSSL 1.0.2 或更高版本支持不同证书的单独证书链。对于较旧的版本，只能使用一个证书链。</p>
</div></div>
<p><a href="" id="ssl_certificate_data"></a></p>
<p>可以指定值<code>data</code>：<code>certificate</code>而不是<code>file</code>(1.15.10)，后者无需使用中间文件即可加载证书。请注意，对此语法的不当使用可能会带来安全隐患，例如将密钥数据写入<a href="ngx_core_module.html#error_log">error log</a>。</p>
<p><a href="" id="ssl_certificate_key"></a></p>
<table>
<thead></thead>
<tbody>
<tr><td>Syntax:</td><td><code>ssl_certificate_key file;</code></td></tr>
<tr><td>Default:</td><td>—</td></tr>
<tr><td>Context:</td><td><code>mail</code> , <code>server</code></td></tr>
</tbody>
</table>
<p>使用给定服务器的 PEM 格式的密钥指定<code>file</code>。</p>
<p>可以指定值<code>engine</code>：<code>name</code>：<code>id</code>而不是<code>file</code>(1.7.9)，后者从 OpenSSL 引擎<code>name</code>加载具有指定<code>id</code>的 Secret 密钥。</p>
<p><a href="" id="ssl_certificate_key_data"></a></p>
<p>可以指定值<code>data</code>：<code>key</code>而不是<code>file</code>(1.15.10)，后者无需使用中间文件就可以加载密钥。请注意，对此语法的不当使用可能会带来安全隐患，例如将密钥数据写入<a href="ngx_core_module.html#error_log">error log</a>。</p>
<p><a href="" id="ssl_ciphers"></a></p>
<table>
<thead></thead>
<tbody>
<tr><td>Syntax:</td><td><code>ssl_ciphers ciphers;</code></td></tr>
<tr><td>Default:</td><td><code>ssl_ciphers HIGH:!aNULL:!MD5;</code></td></tr>
<tr><td>Context:</td><td><code>mail</code> , <code>server</code></td></tr>
</tbody>
</table>
<p>指定启用的密码。密码以 OpenSSL 库可以理解的格式指定，例如：</p>
<pre><code class="hljs language-shell">ssl_ciphers ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
</code></pre>
<p>可以使用“ <code>openssl ciphers</code>”命令查看完整列表。</p>
<div class="alert callout info"><p class="title"><i class="fa fa-info-circle"></i>Note</p><div><p>默认情况下，早期版本的 nginx 使用<a href="http-configuring_https_servers.html#compatibility">different</a>密码。</p>
</div></div>
<p><a href="" id="ssl_client_certificate"></a></p>
<table>
<thead></thead>
<tbody>
<tr><td>Syntax:</td><td><code>ssl_client_certificate file;</code></td></tr>
<tr><td>Default:</td><td>—</td></tr>
<tr><td>Context:</td><td><code>mail</code> , <code>server</code></td></tr>
</tbody>
</table>
<p>该指令出现在 1.7.11 版本中。</p>
<p>使用用于<a href="#ssl_verify_client">verify</a>客户端证书的 PEM 格式指定<code>file</code>具有受信任的 CA 证书。</p>
<p>证书列表将发送给客户端。如果不需要，可以使用<a href="#ssl_trusted_certificate">ssl_trusted_certificate</a>指令。</p>
<p><a href="" id="ssl_crl"></a></p>
<table>
<thead></thead>
<tbody>
<tr><td>Syntax:</td><td><code>ssl_crl file;</code></td></tr>
<tr><td>Default:</td><td>—</td></tr>
<tr><td>Context:</td><td><code>mail</code> , <code>server</code></td></tr>
</tbody>
</table>
<p>该指令出现在 1.7.11 版本中。</p>
<p>使用用于<a href="#ssl_verify_client">verify</a>客户端证书的 PEM 格式指定<code>file</code>带有吊销证书(CRL)。</p>
<p><a href="" id="ssl_dhparam"></a></p>
<table>
<thead></thead>
<tbody>
<tr><td>Syntax:</td><td><code>ssl_dhparam file;</code></td></tr>
<tr><td>Default:</td><td>—</td></tr>
<tr><td>Context:</td><td><code>mail</code> , <code>server</code></td></tr>
</tbody>
</table>
<p>该指令出现在版本 0.7.2 中。</p>
<p>为 DHE 密码指定一个带有 DH 参数的<code>file</code>。</p>
<p>默认情况下，未设置任何参数，因此将不使用 DHE 密码。</p>
<div class="alert callout info"><p class="title"><i class="fa fa-info-circle"></i>Note</p><div><p>在 1.11.0 版之前，默认情况下使用内置参数。</p>
</div></div>
<p><a href="" id="ssl_ecdh_curve"></a></p>
<table>
<thead></thead>
<tbody>
<tr><td>Syntax:</td><td><code>ssl_ecdh_curve curve;</code></td></tr>
<tr><td>Default:</td><td><code>ssl_ecdh_curve auto;</code></td></tr>
<tr><td>Context:</td><td><code>mail</code> , <code>server</code></td></tr>
</tbody>
</table>
<p>该指令出现在 1.1.0 和 1.0.6 版本中。</p>
<p>为 ECDHE 密码指定<code>curve</code>。</p>
<p>使用 OpenSSL 1.0.2 或更高版本时，可以指定多条曲线(1.11.0)，例如：</p>
<pre><code class="hljs language-shell">ssl_ecdh_curve prime256v1:secp384r1;
</code></pre>
<p>特殊值<code>auto</code>(1.11.0)指示 nginx 在使用 OpenSSL 1.0.2 或更高版本或<code>prime256v1</code>(对于较旧的版本)时使用 OpenSSL 库中内置的列表。</p>
<div class="alert callout info"><p class="title"><i class="fa fa-info-circle"></i>Note</p><div><p>在 1.11.0 版之前，默认情况下使用<code>prime256v1</code>曲线。</p>
</div></div>
<p><a href="" id="ssl_password_file"></a></p>
<table>
<thead></thead>
<tbody>
<tr><td>Syntax:</td><td><code>ssl_password_file file;</code></td></tr>
<tr><td>Default:</td><td>—</td></tr>
<tr><td>Context:</td><td><code>mail</code> , <code>server</code></td></tr>
</tbody>
</table>
<p>该指令出现在版本 1.7.3 中。</p>
<p>指定一个带有<a href="#ssl_certificate_key">secret keys</a>密码短语的<code>file</code>，其中每个密码短语都在单独的行上指定。加载密钥时依次尝试使用密码短语。</p>
<p>Example:</p>
<pre><code class="hljs language-shell">mail {
    ssl_password_file /etc/keys/global.pass;
    ...

    server {
        server_name mail1.example.com;
        ssl_certificate_key /etc/keys/first.key;
    }

    server {
        server_name mail2.example.com;

        # named pipe can also be used instead of a file
        ssl_password_file /etc/keys/fifo;
        ssl_certificate_key /etc/keys/second.key;
    }
}
</code></pre>
<p><a href="" id="ssl_prefer_server_ciphers"></a></p>
<table>
<thead></thead>
<tbody>
<tr><td>Syntax:</td><td><code>ssl_prefer_server_ciphers on | off;</code></td></tr>
<tr><td>Default:</td><td><code>ssl_prefer_server_ciphers off;</code></td></tr>
<tr><td>Context:</td><td><code>mail</code> , <code>server</code></td></tr>
</tbody>
</table>
<p>指定当使用 SSLv3 和 TLS 协议时，服务器密码应优先于客户端密码。</p>
<p><a href="" id="ssl_protocols"></a></p>
<table>
<thead></thead>
<tbody>
<tr><td>Syntax:</td><td><code>ssl_protocols [SSLv2] [SSLv3] [TLSv1] [TLSv1.1] [TLSv1.2] [TLSv1.3];</code></td></tr>
<tr><td>Default:</td><td><code>ssl_protocols TLSv1 TLSv1.1 TLSv1.2;</code></td></tr>
<tr><td>Context:</td><td><code>mail</code> , <code>server</code></td></tr>
</tbody>
</table>
<p>启用指定的协议。</p>
<div class="alert callout info"><p class="title"><i class="fa fa-info-circle"></i>Note</p><div><p><code>TLSv1.1</code>和<code>TLSv1.2</code>参数(1.1.13、1.0.12)仅在使用 OpenSSL 1.0.1 或更高版本时有效。</p>
</div></div><div class="alert callout info"><p class="title"><i class="fa fa-info-circle"></i>Note</p><div><p><code>TLSv1.3</code>参数(1.13.0)仅在使用支持 TLSv1.3 的 OpenSSL 1.1.1 时有效。</p>
</div></div>
<p><a href="" id="ssl_session_cache"></a></p>
<table>
<thead></thead>
<tbody>
<tr><td>Syntax:</td><td><code>ssl_session_cache off | none | [builtin[:size]] [shared:name:size];</code></td></tr>
<tr><td>Default:</td><td><code>ssl_session_cache none;</code></td></tr>
<tr><td>Context:</td><td><code>mail</code> , <code>server</code></td></tr>
</tbody>
</table>
<p>设置存储会话参数的缓存的类型和大小。高速缓存可以是以下任何类型：</p>
<ul>
<li>
<p><code>off</code></p>
<ul>
<li>严格禁止使用会话缓存：nginx 明确告知客户端不得重复使用会话。</li>
</ul>
</li>
<li>
<p><code>none</code></p>
<ul>
<li>禁止使用会话缓存：nginx 告诉客户端会话可以被重用，但实际上并没有在缓存中存储会话参数。</li>
</ul>
</li>
</ul>
<h4 id="builtin"><a href="#ssl_session_cache_builtin" id="ssl_session_cache_builtin"></a> builtin</h4>
<ul>
<li>内置 OpenSSL 的缓存；仅由一个工作进程使用。缓存大小在会话中指定。如果未指定大小，则等于 20480 个会话。使用内置缓存可能会导致内存碎片。</li>
</ul>
<h4 id="shared"><a href="#ssl_session_cache_shared" id="ssl_session_cache_shared"></a> shared</h4>
<ul>
<li>所有工作进程之间共享的缓存。缓存大小以字节为单位；一兆字节可以存储大约 4000 个会话。每个共享缓存应具有任意名称。具有相同名称的缓存可以在多个服务器中使用。</li>
</ul>
<p>两种缓存类型可以同时使用，例如：</p>
<pre><code class="hljs language-shell">ssl_session_cache builtin:1000 shared:SSL:10m;
</code></pre>
<p>但仅使用共享缓存而不使用内置缓存应该会更有效率。</p>
<p><a href="" id="ssl_session_ticket_key"></a></p>
<table>
<thead></thead>
<tbody>
<tr><td>Syntax:</td><td><code>ssl_session_ticket_key file;</code></td></tr>
<tr><td>Default:</td><td>—</td></tr>
<tr><td>Context:</td><td><code>mail</code> , <code>server</code></td></tr>
</tbody>
</table>
<p>该指令出现在 1.5.7 版中。</p>
<p>设置带有用于加密和解密 TLS 会话票证的密钥的<code>file</code>。如果必须在多个服务器之间共享同一密钥，则该指令是必需的。默认情况下，使用随机生成的密钥。</p>
<p>如果指定了多个密钥，则仅第一个密钥用于加密 TLS 会话票证。这允许配置键旋转，例如：</p>
<pre><code class="hljs language-shell">ssl_session_ticket_key current.key;
ssl_session_ticket_key previous.key;
</code></pre>
<p><code>file</code>必须包含 80 或 48 个字节的随机数据，并且可以使用以下命令创建：</p>
<pre><code class="hljs language-shell">openssl rand 80 &gt; ticket.key
</code></pre>
<p>根据文件大小，使用 AES256(对于 80 字节密钥为 1.11.8)或 AES128(对于 48 字节密钥)进行加密。</p>
<p><a href="" id="ssl_session_tickets"></a></p>
<table>
<thead></thead>
<tbody>
<tr><td>Syntax:</td><td><code>ssl_session_tickets on | off;</code></td></tr>
<tr><td>Default:</td><td><code>ssl_session_tickets on;</code></td></tr>
<tr><td>Context:</td><td><code>mail</code> , <code>server</code></td></tr>
</tbody>
</table>
<p>该指令出现在 1.5.9 版中。</p>
<p>通过<a href="javascript:window.open('https://tools.ietf.org/html/rfc5077');" target="_blank" rel="noopener noreferrer">TLS 会话票</a>启用或禁用会话恢复。</p>
<p><a href="" id="ssl_session_timeout"></a></p>
<table>
<thead></thead>
<tbody>
<tr><td>Syntax:</td><td><code>ssl_session_timeout time;</code></td></tr>
<tr><td>Default:</td><td><code>ssl_session_timeout 5m;</code></td></tr>
<tr><td>Context:</td><td><code>mail</code> , <code>server</code></td></tr>
</tbody>
</table>
<p>指定客户端可以重用会话参数的时间。</p>
<p><a href="" id="ssl_trusted_certificate"></a></p>
<table>
<thead></thead>
<tbody>
<tr><td>Syntax:</td><td><code>ssl_trusted_certificate file;</code></td></tr>
<tr><td>Default:</td><td>—</td></tr>
<tr><td>Context:</td><td><code>mail</code> , <code>server</code></td></tr>
</tbody>
</table>
<p>该指令出现在 1.7.11 版本中。</p>
<p>使用用于<a href="#ssl_verify_client">verify</a>客户端证书的 PEM 格式指定<code>file</code>具有受信任的 CA 证书。</p>
<p>与<a href="#ssl_client_certificate">ssl_client_certificate</a>设置的证书相反，这些证书的列表不会发送给客户端。</p>
<p><a href="" id="ssl_verify_client"></a></p>
<table>
<thead></thead>
<tbody>
<tr><td>Syntax:</td><td><code>ssl_verify_client on | off | optional | optional_no_ca;</code></td></tr>
<tr><td>Default:</td><td><code>ssl_verify_client off;</code></td></tr>
<tr><td>Context:</td><td><code>mail</code> , <code>server</code></td></tr>
</tbody>
</table>
<p>该指令出现在 1.7.11 版本中。</p>
<p>启用客户端证书的验证。验证结果在<a href="mail-ngx_mail_auth_http_module.html#auth_http">authentication</a>请求的“ Auth-SSL-Verify”Headers 中传递。</p>
<p><code>optional</code>参数请求客户端证书，并验证该证书是否存在。</p>
<p><code>optional_no_ca</code>参数请求客户端证书，但不需要由受信任的 CA 证书对其进行签名。这用于在 nginx 外部的服务执行实际证书验证的情况下使用。可通过对验证服务器的请求<a href="mail-ngx_mail_auth_http_module.html#auth_http_pass_client_cert">sent</a>访问证书的内容。</p>
<p><a href="" id="ssl_verify_depth"></a></p>
<table>
<thead></thead>
<tbody>
<tr><td>Syntax:</td><td><code>ssl_verify_depth number;</code></td></tr>
<tr><td>Default:</td><td><code>ssl_verify_depth 1;</code></td></tr>
<tr><td>Context:</td><td><code>mail</code> , <code>server</code></td></tr>
</tbody>
</table>
<p>该指令出现在 1.7.11 版本中。</p>
<p>设置客户端证书链中的验证深度。</p>
<p><a href="" id="starttls"></a></p>
<table>
<thead></thead>
<tbody>
<tr><td>Syntax:</td><td><code>starttls on | off | only;</code></td></tr>
<tr><td>Default:</td><td><code>starttls off;</code></td></tr>
<tr><td>Context:</td><td><code>mail</code> , <code>server</code></td></tr>
</tbody>
</table>
<ul>
<li>
<p><code>on</code></p>
<ul>
<li>允许对 POP3 使用<code>STLS</code>命令，对 IMAP 和 SMTP 使用<code>STARTTLS</code>命令；</li>
</ul>
</li>
<li>
<p><code>off</code></p>
<ul>
<li>拒绝使用<code>STLS</code>和<code>STARTTLS</code>命令；</li>
</ul>
</li>
<li>
<p><code>only</code></p>
<ul>
<li>需要进行初步的 TLS 转换。</li>
</ul>
</li>
</ul>
</div>
</div>
</section>
<div class="right-sidebar">
<div class="affix"><ins class="adsbygoogle" style="display:block" data-ad-client="ca-pub-6108808167664152" data-ad-slot="3102929424" data-ad-format="auto" data-full-width-responsive="true"></ins>
<script>
     (adsbygoogle = window.adsbygoogle || []).push({});
</script></div>
</div>
</div>
<div class="ft">
<a href="#toolbar-title" id="anchorNavigationExGoTop"><i class="fa fa-arrow-up"></i></a>
<footer class="footer">
<div class="footer__container--normal">
<img alt="扫码关注公众号" title="扫码关注公众号" src="static/picture/qr-code.png" width="170" height="170">
<div class="footer__description--normal">
<p class="paragraph footer__author--normal">Docs4dev<sup class="super">&#xAE;</sup>
</p>
<p class="paragraph footer__quote&#45;&#45;normal">
如果你在使用过程中遇到任何问题，可以在 <a href="javascript:window.open('https://github.com/docs4dev/docs4dev-issues');" target="_blank" rel="noopener noreferrer">这里<i class="fa fa-external-link"></i></a> 提issue。
</p>
<div class="footer__main--normal">
<p class="paragraph footer__main__paragraph--normal copyright" style="color: #666 !important;">
<a href="javascript:window.open('https://beian.miit.gov.cn/');">
蜀ICP备14021783号-6
</a>
</p>
<p class="paragraph footer__main__paragraph--normal copyright" style="color: #666 !important;">
Copyright &#xA9; Docs4dev all
right reserved, powered by <a href="index2.html" target="_blank">Docs4dev</a></p>
</div>
</div>
</div>
<div class="box__issues">
</div>
</footer>
</div>
</div>
</div>
</div>
</div>
<script>
  var hasToc = true;
  /*  var downloadable = /!*false*!/ false;
    var editable = /!*false*!/ false;
    var code = /!*"nginx"*!/ false;
    var version = /!*"current"*!/ false;
    var type = /!*"reference"*!/ false;
    var lang = /!*"zh"*!/ 'en';
    //edit link
    require(["gitbook", "jQuery"], function (gitbook, $) {
      gitbook.events.bind('start', function (e, config) {
        // Add edit toolbar to left
        var chapterId = /!*17728*!/ 0;
        if (downloadable) {
          gitbook.toolbar.createButton({
            icon: 'fa fa-download',
            text: '下载',
            onClick: function () {
              window.open('/download?code=' + code + '&version=' + version + '&type=' + type + '&lang=' + lang);
            }
          });
        }
        if (editable) {
          gitbook.toolbar.createButton({
            icon: 'fa fa-edit',
            text: '编辑此页',
            onClick: function () {
              window.open('/docs/edit?chapterId=' + chapterId + '&lang=' + lang);
            }
          });
        }
      });
    });*/
</script>
<script>
    var code = "nginx";
    var lang = "zh";
  </script>

<script src="static/js/autocomplete-js.js"></script>
<script src="static/js/app.min.js"></script>
<script src="static/js/search.min.js"></script>
</body>
</html>
